Live › vulnerability › CVE-2026-118179
Go to dashboardClicking a news: or snews: link with a crafted message-ID made Thunderbird open a connection to whatever host and port the link named, even if it was not a configured news server. Line breaks in the message-ID were passed to the server unchanged, so the link could send arbitrary commands to services reachable from the user's network, and snews: links connected without TLS.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Anyone running Thunderbird builds before the fixed versions who can be sent or can open a news: or snews: link. The exposure is on desktop machines where the user clicks such a link, and the reachable targets are services on that user's network. Teams that never use news links and do not run Thunderbird on managed desktops can skip it.
No product ranges from the sources yet.
thunderbird --version on the machine153.6 or later on the 153 line, or to 159 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.